System log question

Whenever I boot the system, I see the message below in the System Event
log, issued by wininit. The Details section of the entry lists dozens of
programs, some are applications and others are system modules. What does
this mean? Something malware-related comes to mind, but none of the usual
tools finds anything suspicious.


Log Name: System
Source: Microsoft-Windows-Wininit
Date: 3/11/2015 10:27:22 AM
Event ID: 11

Description:
Custom dynamic link libraries are being loaded for every application. The
system administrator should review the list of libraries to ensure they
are related to trusted applications.

On Wed, 11 Mar 2015 15:47:05 +0000 "Stormin' Norman"
wrote in article

On the right hand side of the event viewer you can copy the entire event. Please
do so and post it here.

Will do when I'm in front of that machine later.

"Jason" wrote in message ...
Whenever I boot the system, I see the message below in the System Event
log, issued by wininit. The Details section of the entry lists dozens of
programs, some are applications and others are system modules. What does
this mean? Something malware-related comes to mind, but none of the usual
tools finds anything suspicious.


Log Name: System
Source: Microsoft-Windows-Wininit
Date: 3/11/2015 10:27:22 AM
Event ID: 11

Description:
Custom dynamic link libraries are being loaded for every application. The
system administrator should review the list of libraries to ensure they
are related to trusted applications.

Apparently, if an application loads a DLL via AppInit it adds 1 to a registry key.
Unfortunately, when the program is uninstalled it may not change it back to its previous state.
So Windows gets confused about loaded DLLs being actually loaded by AppInit.
To fix the problem change this key to its default value of zero:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs

..

In article om, 1@
2.com says...



Apparently, if an application loads a DLL via AppInit it adds 1 to a registry key.
Unfortunately, when the program is uninstalled it may not change it back to its previous state.
So Windows gets confused about loaded DLLs being actually loaded by AppInit.
To fix the problem change this key to its default value of zero:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs

Thanks!

On 11/03/2015 11:53 AM, Dave-UK wrote:
Apparently, if an application loads a DLL via AppInit it adds 1 to a
registry key.
Unfortunately, when the program is uninstalled it may not change it back
to its previous state.
So Windows gets confused about loaded DLLs being actually loaded by
AppInit.
To fix the problem change this key to its default value of zero:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs

Yup, that is the right answer. This has happened to me so often on my
systems that, I have actually made that location one of my favourites in
the Regedit, so I can get to it right away.

Though it's not a huge deal, it does rank as a major annoyance. Due to
all of the specific DLL's being loaded separately, it slows down your
boot process to a bog slow pace, even on an SSD.

Yousuf Khan

On Wed, 11 Mar 2015 15:53:52 -0000 "Dave-UK" wrote in article
om
are being loaded for every application. The
system administrator should review the list of libraries to ensure they
are related to trusted applications.

Apparently, if an application loads a DLL via AppInit it adds 1 to a registry key.
Unfortunately, when the program is uninstalled it may not change it back to its previous state.
So Windows gets confused about loaded DLLs being actually loaded by AppInit.
To fix the problem change this key to its default value of zero:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs

I reset that value and will keep an eye on the log for a while to see if
the warning reoccurs.